// hook_posix_spawn.js
Interceptor.attach(Module.findExportByName(null, "posix_spawn"), {
    onEnter: function(args) {
        // 参数说明:
        // args[0]: pid_t *pid
        // args[1]: const char *path  
        // args[2]: const posix_spawn_file_actions_t *file_actions
        // args[3]: const posix_spawnattr_t *attrs
        // args[4]: char *const argv[]
        // args[5]: char *const envp[]
        
        var path = args[1].readCString();
        console.log("[posix_spawn] 执行路径: " + path);
        
        // 解析命令行参数
        var argv = args[4];
        if (!argv.isNull()) {
            console.log("[posix_spawn] 参数:");
            var i = 0;
            while (true) {
                var argPtr = argv.add(i * Process.pointerSize).readPointer();
                if (argPtr.isNull()) break;
                
                var arg = argPtr.readCString();
                if (arg) {
                    console.log("  [" + i + "] " + arg);
                }
                i++;
            }
        }
    },
    onLeave: function(retval) {
        console.log("[posix_spawn] 返回值: " + retval);
        console.log("----------------------------------------");
    }
});